The NIS2 Directive marks a decisive escalation in Europe’s approach to cyber-security. Replacing the 2016 Network and Information Security Directive, it expands regulatory scope, tightens reporting timelines and embeds cyber-risk oversight at board level.